Most organizations preparing for a PCI DSS assessment focus on their systems, data, and controls. Understandable. But there’s a lesser-known requirement that catches companies off guard: the geographic authorization of the company carrying out the assessment itself. Get this wrong, and the whole assessment could be invalid. What a PCI QSA Region Actually Is The…
A QSA (Qualified Security Assessor) company or an ASV (Approved Scanning Vendor) company is not considered a service provider in the context of the Payment Card Industry Data Security Standard (PCI DSS). They are highly specialized assessors and validators, rather than service providers involved in processing, storing, or transmitting cardholder data. I have seen many…
Merchants that use Scottsdale, Ariz.-based security services provider Chief Security Officers (CSO) to validate their adherence with the Payment Card Industry Data Security Standard (PCI DSS) will have to find a new assessor. The PCI Security Standards Council, the group responsible for managing payment security, last week revoked CSO’s status as a Qualified Security Assessor…
